Here is my sample data { "applications": [ { "id": 2537302, "name": "addressdb_prod", "language": "dotnet", "health_status": "unknown", "reporting": true, "last_reported_at": "2017-08-03T10:41:52+00:00", "application_summary": { "response_time": 5.04, "throughput": 32.3, "error_rate": 0.0, "apdex_target": 0.5, "apdex_score": 1.0, "host_count": 2, "instance_count": 2 }, "settings": { "app_apdex_threshold": 0.5, "end_user_apdex_threshold": 7.0, "enable_real_user_monitoring": true, "use_server_side_config": false }, "links": { "application_instances": [ 2536708, 2561561 ], "servers": [ 25610567, 22686416 ], "application_hosts": [ 2536699, 2561553 ] } }, { "id": 2537304, "name": "addressdb_trn", "language": "dotnet", "health_status": "unknown", "reporting": true, "last_reported_at": "2017-08-03T10:41:47+00:00", "application_summary": { "response_time": 4.93, "throughput": 32.0, "error_rate": 0.0, "apdex_target": 0.5, "apdex_score": 1.0, "host_count": 2, "instance_count": 2 }, "settings": { "app_apdex_threshold": 0.5, "end_user_apdex_threshold": 7.0, "enable_real_user_monitoring": true, "use_server_side_config": false }, "links": { "application_instances": [ 2536709, 2561556 ], "servers": [ 25610567, 22686416 ], "application_hosts": [ 2536699, 2561553 ] } }, { "id": 2268424, "name": "All unnamed", "language": "dotnet", "health_status": "unknown", "reporting": true, "last_reported_at": "2017-08-03T10:41:52+00:00", "application_summary": { "response_time": 5.31, "throughput": 276.0, "error_rate": 0.0, "apdex_target": 0.5, "apdex_score": 1.0, "host_count": 7, "instance_count": 17 }, "settings": { "app_apdex_threshold": 0.5, "end_user_apdex_threshold": 7.0, "enable_real_user_monitoring": true, "use_server_side_config": false }, "links": { "application_instances": [ 38654227, 15703550, 47088155, 45753664, 19172730, 2561560, 19335897, 3249555, 14322182, 14322163, 3249553, 2536710, 2561555, 32941739, 32941738 ], "servers": [ 14652052, 13742329, 47086419, 45753649, 22686416, 2512533, 25610567 ], "application_hosts": [ 19172728, 2545902, 47088154, 45753663, 2561553, 2474911, 2492596, 2536699 ] } }, { "id": 2569403, "name": "allaboutme_dev", "language": "dotnet", "health_status": "gray", "reporting": false, "settings": { "app_apdex_threshold": 0.5, "end_user_apdex_threshold": 7.0, "enable_real_user_monitoring": true, "use_server_side_config": false }, "links": { "application_instances": [], "servers": [], "application_hosts": [] } }, { "id": 17088365, "name": "api_cop_dev_emos", "language": "dotnet", "health_status": "gray", "reporting": false, "settings": { "app_apdex_threshold": 0.5, "end_user_apdex_threshold": 7.0, "enable_real_user_monitoring": true, "use_server_side_config": false }, "links": { "application_instances": [], "servers": [], "application_hosts": [] } } ], "links": { "application.servers": "/v2/servers?ids={server_ids}", "application.server": "/v2/servers/{server_id}", "application.application_hosts": "/v2/application/{application_id}/hosts?ids={host_ids}", "application.application_host": "/v2/application/{application_id}/hosts/{host_id}", "application.application_instances": "/v2/application/{application_id}/instances?ids={instance_ids}", "application.application_instance": "/v2/application/{application_id}/instances/{instance_id}", "application.alert_policy": "/v2/alert_policies/{alert_policy_id}" } } I tried to follow the link https://answers.splunk.com/answers/289520/how-to-split-a-json-array-into-multiple-events-wit.html with configs in my props.conf file [json_no_timestamp:nrc] SHOULD_LINEMERGE=false LINE_BREAKER=((?<!"),|[\r\n]+) SEDCMD-remove_prefix=s/{"applications":\[//g SEDCMD-remove_suffix=s/\]}//g However, it does not seem to work. I assume, most likely, the regex is not correct. Venturing spath options as well. Any help will be appreciated. ... View more

I am able to extract some fields, but not all from sample data as per below for 2 events. Please note that variable, type, and value occurs multiple times in an event and the number of recurrences can vary from one event to another. In the 1st event, these combinations (variable, type and value) occur 6 times, whereas in the 2nd event, only 2 times. How can I extract these fields at search time via props.conf? >>>> 02 Dec 2016 11:11:58 - Unhandled (Source not monitored) SNMPv2 Trap (enterpriseSpecific = 83) Generic: 6 Specific: 83 Enterprise Oid: 1.3.6.1.4.1.14179.2.6.3 Source: 10.x.x.x Community: xxxxx Variable: 1.3.6.1.2.1.1.3.0 Type: Time Click Value: 1827840700 Variable: 1.3.6.1.6.3.1.1.4.1.0 Type: OID Value: 1.3.6.1.4.1.14179.2.6.3.83 Variable: 1.3.6.1.4.1.14179.2.2.1.1.1.0 Type: String Value: 00-50-56-8A-18-62 Variable: 1.3.6.1.4.1.14179.2.2.1.1.3.0 Type: String Value: Variable: 1.3.6.1.4.1.14179.2.5.22.1.2.0 Type: Integer Value: 4 Variable: 1.3.6.1.4.1.14179.2.6.2.69.0 Type: Integer Value: 2 >>>> 02 Dec 2016 14:00:33 - Unhandled (Source not monitored) SNMPv1 Trap (enterpriseSpecific = 1) Generic: 6 Specific: 1 Enterprise Oid: 1.3.6.1.4.1.9.9.43.2 Source: 10.x.x.x Community: xxxxx Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.3.60802 Type: Integer Value: 2 Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.4.60802 Type: Integer Value: 2 Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.5.60802 Type: Integer Value: 3 ... View more

I have several searches, about 10, each of which produces a CSV file as an output. I would like to run this as scheduled jobs on a weekly/monthly basis. Is there a way to combine all these searches into one so that I can run only one scheduled search instead of 10? A sample search will look like below: index=index1 sc_status=200 pdf1.pdf | timechart span=1d count | eval _time=strftime(_time, "%d/%m/%Y") | rename _time as Date count as Downloads | addcoltotals labelfield=Date label="Total PDF Downloads" | outputcsv pdf1.csv I looked at multisearch command , not sure if that is an answer. ... View more

I have certain logs which are indexed correctly. Field extraction using props.conf and transforms.conf works correctly when I am searching within the indexer. However, when I am copying the same set of props and transforms file to the search head, field extraction does not work. I have put props and transforms under .../ets/apps/search/local in the search head and trying to search within the apps search. Looks like seems something else is taking precedence. I am just searching: sourcetype=cf There is only one type of data in that index. My question is, is there a way to find which props and/or transforms file applied to a specific sourcetype? I tried the following command splunk cmd btool --app=search props list which shows the following output [cf] DATETIME_CONFIG = FIELDALIAS-src = c_ip AS src KV_MODE = none MAX_TIMESTAMP_LOOKAHEAD = 20 NO_BINARY_CHECK = true REPORT-cfx = kv_for_cf SHOULD_LINEMERGE = True TRANSFORMS-sourcetype = nullPound category = Web description = AWS cloudfront logs pulldown_type = true [cisco_wsa_squid] EVAL-MB = sc_bytes/(1024*1024) [ironport_proxy] [splunk_web_service] EXTRACT-useragent = userAgent=(?P<browser>[^ (]+) [splunkd] EXTRACT-fields = (?i)^(?:[^ ]* ){2}(?:[+\-]\d+ )?(?P<log_level>[^ ]*)\s+(?P<component>[^ ]+) - (?P<message>.+) ... View more